Digital Health, Telemedicine and Medical Device Software Regulation in Kenya

Digital health regulation in Kenya now operates on two tracks. The Digital Health Act, 2023 governs health information systems, telemedicine platforms and the health data they handle. Separately, the Pharmacy and Poisons Board (PPB) regulates software that functions as, or inside, a medical device. A telemedicine or health-tech product may have to satisfy both regimes at once, and they are run by different bodies with different logic.

The Digital Health Act and its 2025 Regulations

The Digital Health Act (No. 15 of 2023), which commenced on 2 November 2023, established the Digital Health Agency, which is responsible for Kenya’s Comprehensive Integrated Health Information System. Two sets of regulations made in 2025 give the Act operational content: the Digital Health (Health Information Management Procedures) Regulations (Legal Notice 76 of 2025) and the Digital Health (Data Exchange Component) Regulations (Legal Notice 77 of 2025).

Legal Notice 76 requires the Agency to certify digital health solutions, including e-health and telemedicine platforms, in accordance with a Certification Framework. It also requires the Agency to retain health data held in the System for a minimum of twenty years or as the Act specifies. Legal Notice 77 establishes a telemedicine health provider registry in the System, intended to be the single source of reference for the provision of telemedicine in Kenya, and requires certified digital health solutions to submit a minimum data set to the System.

Certification of a digital health solution

Certification is a documented process, not a formality. Under regulation 38 of Legal Notice 76, a digital health solution provider applies to the Agency on Form HMIS 4. Before applying, the provider must undertake self-attestation on the solution and prepare a self-attestation report. The application must be accompanied by, among other things:

• the self-attestation report and the applicant’s certificate of incorporation;
• particulars of the health data controller;
• a system manual and requirements specification for the solution; and
• evidence of registration with the Office of the Data Protection Commissioner as a data controller and data processor, together with the data protection impact assessment required under the Data Protection Act.

A certificate is valid for two years from the date of issuance. The Second Schedule to Legal Notice 76 sets the gazetted certification fees: a vendor application fee of KES 20,000, then KES 250,000 for telemedicine, KES 50,000 for an mHealth solution, KES 100,000 for testing an outpatient-only health management information system, and KES 500,000 for testing a hospital-wide system proof of concept. Innovators and students pay system-testing fees up to a maximum of KES 10,000. These are materially higher than the fees for many other licensing categories, so budget for them at the design stage.

Who may provide telemedicine

Legal Notice 77 defines a telemedicine health provider as a healthcare worker who is qualified, registered and licensed to practise in Kenya and who provides telemedicine services. A platform therefore cannot simply onboard any willing clinician. It must confirm that each clinician holds a valid Kenyan practising licence, in addition to whatever qualifications they hold elsewhere, because the registry is meant to be the authoritative list of who may deliver telemedicine in Kenya.

Medical device software: a second, separate regime

Software can also be regulated as a medical device. In April 2026, the press reported that PPB had published a Guideline on Regulation of Medical Device Software in Kenya. As reported, it takes a risk-based approach and distinguishes software as a medical device (SaMD), meaning standalone software with a medical purpose, such as an application that analyses scans, from software in a medical device (SiMD), meaning software embedded in hardware. It is said to draw on the framework of the International Medical Device Regulators Forum. We have not been able to locate the guideline’s text on PPB’s website, so we do not state its documentation requirements, fees or timelines here. Confirm them with PPB before a launch.

The underlying device registration regime is already in force. Under the Pharmacy and Poisons (Registration of Health Products and Technologies) Rules (Legal Notice 100 of 2022), a person may not import, manufacture or sell a health product or technology in Kenya unless it is registered. Our guide to medical device and health product registration sets out that process and the fees by device class.

Two regulators, one product

A telemedicine platform that also runs diagnostic algorithms may need Digital Health Agency certification for the platform and data-handling layer, and separate PPB registration for the diagnostic component if it independently qualifies as a medical device. These are not alternative routes. They can both apply to one product, with different documents, fees and validity periods. Mapping the regulatory touchpoints at design stage is cheaper than retrofitting data protection impact assessments and software design records onto a finished product.

Data protection overlay

Health data is sensitive personal data under the Data Protection Act, 2019. Because regulation 38 requires evidence of registration with the Data Protection Commissioner and a data protection impact assessment as part of the certification application, data protection registration is a practical precondition to a certified platform, not a track that can be dealt with later. Section 47 of the Digital Health Act also deals with the disclosure of sensitive personal data to organisations outside Kenya, so a platform that uses foreign cloud hosting or foreign specialists should review that section with its data protection advice.

Frequently asked questions

This article is general information on Kenyan law as at its publication date, not legal advice. Reading it does not create an advocate and client relationship.